CVE-2026-44645 is an uncontrolled resource consumption vulnerability (CWE-400) in the LiquidJS template engine (harttle project). The renderLimit option, designed to limit the time spent in each render() call, can be bypassed when the loop body of {% for %} or {% tablerow %} tags is empty. Because the per-iteration time check only occurs if the loop body contains at least one template node, an empty loop iterates the entire collection without limitation. This can cause a single parseAndRenderSync call to consume significantly more time than the configured renderLimit (e.g., 2.26 seconds vs. 50 ms limit), scaling linearly with the iteration count. This allows a low-privileged template author to monopolize the Node.js event loop worker thread, potentially stalling other requests and causing availability issues. The vulnerability affects versions up to and including 10.25.7 and was fixed in version 10.26.0.

An attacker who can supply templates can bypass the renderLimit protection and cause excessive CPU consumption on the Node.js event loop by crafting empty loop bodies that iterate large collections. This results in denial of service by stalling event-loop workers and impacting availability of the service processing templates. There is no impact on confidentiality or integrity.

A fix is available in LiquidJS version 10.26.0. Users should upgrade to version 10.26.0 or later to resolve this vulnerability. No other vendor advisories or temporary mitigations are provided. Until upgraded, deployments relying on renderLimit for DoS protection remain vulnerable to crafted templates with empty loop bodies.